############################################################################
##
## Copyright (c) 2000 BalaBit IT Ltd, Budapest, Hungary
##
## This program is free software; you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
## the Free Software Foundation; either version 2 of the License, or
## (at your option) any later version.
##
## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
## GNU General Public License for more details.
##
## You should have received a copy of the GNU General Public License
## along with this program; if not, write to the Free Software
## Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
##
## $Id: policy.py.sample,v 1.10.2.2 2001/02/16 10:34:57 bazsi Exp $
##
############################################################################

#
# sample firewall policy with transparent access to FTP, HTTP and CVS protocols.
# For FTP and HTTP we use application level gateways, for CVS we use a plug.
# (as long as CVS protocol proxy is not available)
#
# firewall internal network: 192.168.1.0/24
# firewall internal interface: 192.168.1.1
# firewall external interface: 193.225.235.6
#

from Zorp.Zorp import *
from Zorp import Zorp
from Zorp.Zone import InetZone
from Zorp.Service import Service
from Zorp.SockAddr import SockAddrInet
from Zorp.Chainer import TransparentChainer, DirectedChainer, InbandChainer, FailoverChainer
from Zorp.Plug import PlugProxy
from Zorp import Http
from Zorp.Http import HttpProxy
from Zorp.Ftp import FtpProxyAllow, FtpProxyMinimal
from Zorp.Listener import Listener


Zorp.firewall_name = 'zorp@site'

InetZone("site-net", "192.168.1.0/24", 
	 # list of allowed outbound services, '*' matches anything
	 outbound_services=["intra_http", "intra_ftp", "intra_cvs"],
		
	 # list of allowed inbound services, '*' matches anything
	 inbound_services=[]),
		
InetZone("local", "127.0.0.0/8",
         inbound_services=["*"],
         outbound_services=[]),
        
InetZone("internet", "0.0.0.0/0",
         inbound_services=["*"],
         outbound_services=[])

# 
# Here's a proxy event handler definition. We are deriving from a
# simple plug proxy, which is blindly copying in both directions.
#
# Instances of this class represent a "plug proxy". For a complete
# documentation for the features and available attributes of plug see the
# file /doc/modules/plug.txt
#

class IntraCvs(PlugProxy):

        def config(self):
        
     		""" The config event is sent in configuration state, some attributes
     		can only be set here. """
     		
        	# uncommenting this would make this plug one-way only (server->client)
                #self.copy_to_server = FALSE
                # same but client->server copying would only be performed
                #self.copy_to_client = FALSE

                self.packet_stats_interval = 100

	def startUp(self):
		""" startUp is called after configuration, but before any data
		is transferred. """
		
		# this is empty now
		pass
						
	def shutDown(self):
		""" called just before terminating the proxy. """
		pass
		
	def packetStats(self, client_bytes, client_pkt, server_bytes, server_pkt):
		""" plug is sending this event after self.packet_stats_interval number
		of packets had been transferred. """
		
		# report traffic information
		message(0, "server->client: packet=%d, bytes=%d, bandwidth=%f" % (client_pkt, client_bytes, self.bandwidth_to_client))
		message(0, "client->server: packet=%d, bytes=%d, bandwidth=%f" % (server_pkt, server_bytes, self.bandwidth_to_server))
		return 1
		

#
# Let's define a transparent http proxy, which rewrites the user_agent
# header to something different.
#
class IntraHttp(HttpProxy):

        def config(self):
        	HttpProxy.config(self)
                self.transparent_mode = TRUE
                self.request_headers["User-Agent"] = (Http.HTTP_CHANGE_VALUE, "Lynx/2.8.3rel.1")
                self.request["GET"] = (Http.HTTP_POLICY, self.filterURL)
                # self.parent_proxy = "proxy.site.net"
                # self.parent_proxy_port = 3128
                # self.timeout = 60000
                # self.max_keepalive_requests = 10
                
	def filterURL(self, method, url, version):
	        # return Z_REJECT here to reject this request
	        # change self.request_url to redirect to another url
	        # change connection_mode to HTTP_CONNECTION_CLOSE to force kept-alive connections to close
	        log("http.info", 3, "%s: GET: %s" % (self.session.session_id, url))

class IntraFtp(FtpProxyAllow):
	def config(self):
		FtpProxyAllow.config(self)
		self.transparent_mode = TRUE

#
# name is passed to the Zorp instance with the --as command line option
# you can use it to start different services for different names
# In this simple policy we ignore it.
#
def init(name):
	debug(0, "Policy init, name=%s" % name)
	
	# create services
	Service("intra_cvs", TransparentChainer(), IntraCvs)
	Service("intra_http", InbandChainer(), IntraHttp)
	Service("intra_ftp", TransparentChainer(), IntraFtp)
	
	# bind services to listeners
	# you'll need the packet filter redirect these connections, and
	# to protect transparent listeners, since if you connect to
	# a transparent listener directly, Zorp reconnects to itself.
	Listener(SockAddrInet("192.168.1.1", 50080), "intra_http")
	Listener(SockAddrInet("192.168.1.1", 50021), "intra_ftp")
	Listener(SockAddrInet("192.168.1.1", 52401), "intra_cvs")


debug(0, "Policy bootstrap done...");
